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HIGH-RATE QUANTUM KEY DISTRIBUTION SCHEME RELYING ON 
CONTINUOUSLY PHASE AND AMPLITUDE-MODULATED COHERENT LIGHT 

PULSES 



Related Applications 

[0001] This patent application takes priority from U.S. Provisional 

Application No. 60/394,330, filed on July 5, 2002, which is hereby incorporated by 
reference. 

Field of the Invention 

[0002] The present invention is related to the distribution of a random bit string 
between two authorised parties, for use as a secret key in a secure i.e., encrypted and 
authenticated communication. 

[0003] The key distribution uses quantum carriers, typically single-photon or 
strongly attenuated pulses, for encoding the key bits. It is supplemented with classical post- 
processing algorithms, namely reconciliation and privacy amplification algorithms, in order 
to distil the secret key. 

[0004] The Heisenberg uncertainty principle of quantum mechanics, together 
with the use of a privacy amplification protocol, guarantees that an unauthorised third party 
(any eavesdropper) cannot gain any information on the secret key. 

State of the Art 

[0005] Quantum key distribution (QKD), usually known as quantum 
cryptography, is presently the most advanced application of quantum communication. QKD 
has been proposed in 1984 by C. H. Bennett and G. Brassard as a technique for distributing a 
secret key, i.e., a random bit string, between two authorised parties that relies on quantum 
mechanics. This secret key, also called symmetric key, can then be used by the parties to 
transmit a confidential message by use of a standard cryptographic method such as the 
Vernam code, which is unconditionally secure. It can also be used to authenticate the 
communication, i.e., distinguish legitimate messages from fake ones. 
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[0006] Quantum key distribution requires a quantum channel supplemented with 
a (classical) authenticated public channel. Typically, a sequence of light pulses is sent in the 
quantum channel, encoding each a key bit. The quantum properties of light, in particular the 
Heisenberg uncertainty principle, ensure that no information can be gained on these key bits 
without disturbing the quantum state of the photons. Public communications over the 
classical channel are then used to estimate the maximum amount of information that a 
potential eavesdropper may have acquired, and distil a secret key out of the raw data. 

[0007] Several practical schemes for quantum key distribution have been 
proposed and implemented over the last ten years. The present state-of-the-art quantum 
cryptographic schemes make use of a binary encoding of the key using ideally single-photon 
states, or, in practice, very faint coherent states containing on average a fraction of a photon 
per pulse. The secret key rate is limited due to the need for photon-counting detectors, which 
have a relatively low maximum repetition frequency in order to keep the detectors afterpulse 
probability negligible. In addition, the range over which the security is guaranteed is limited 
by a threshold on the quantum bit error rate, which is reached above a certain attenuation 
(beyond a certain range) as a consequence of the detector's dark counts. A review of quantum 
cryptography can be found in ref. l . 

[0008] Another potential implementation of QKD that was raised very recently 
consists in using quantum continuous variables (QCV) 29 , such as the electric field 
amplitudes, to obtain possibly more efficient alternatives to usual photon-counting QKD 
techniques. 

[0009] Many recent proposals 2 " 10 to use QCV for QKD have been made that are 
based on the use of "non-classical" light beams, namely squeezed light or entangled light 
beams ("EPR beams"). In contrast, embodiments of the present invention discuss the use of 
"quasi-classical" (coherent) light beams. U.S. Patent No. 5,515,438, hereby incorporated by 
reference, describes a quantum key distribution using non-orthogonal macroscopic signals. 
Summary of Certain Aspects of the Invention 

[0010] Embodiments of the present invention are a potential alternative to the 
usual single-photon quantum cryptographic techniques devised so far. Key carriers used are 
quasi-classical (coherent) light pulses that contain many photons and are continuously 
modulated in amplitude and phase 11 . The continuous raw data is then converted into a usable 
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binary key using a continuous reconciliation protocol 9,22 . In contrast to previous proposals, 
this shows that there is no need for squeezed light in the context of QCV QKD: an equivalent 
level of security may be obtained simply by generating and transmitting continuous 
distributions of coherent states, an easier task compared to generating squeezed states or 
single-photon states. 

[0011] More specifically, embodiments of the present invention distribute secret 
keys at a high rate over long distances. A protocol uses shot-noise limited coherent 
(homodyne) detection, which works at much higher repetition frequencies than single-photon 
detectors, so that high secret-bit rates can indeed be achieved. It remains, in principle, secure 
for very lossy transmission lines by use of a reverse reconciliation algorithm, so it may 
therefore be used over long distances. 

[0012] One further goal of the invention is to demonstrate the practicability of the 
QCV QKD protocol when using Gaussian-modulated coherent states that are laser pulses 
containing several photons. The scope of the invention is not restricted to Gaussian 
distributions (other continuous distributions may be used as well) but this makes the 
demonstration easier. Embodiments of the invention cover the security analysis of the 
protocol and a proof-of-principle experimental implementation, followed by the complete 
secret key extraction, including data reconciliation and privacy amplification. The tested set- 
up yields a secret key rate of approximately 1.7 Mbps for a lossless line and of 75 kbps for a 
3.1 dB line. 

[0013] Embodiments of this invention describe the distribution of a secret key 
between two remote parties by use of quantum coherent states, e.g., attenuated laser pulses, 
that are continuously modulated in phase and amplitude. Coherent (homodyne) detection is 
then performed by the receiver in order to measure the quadrature components of these 
states. 

[0014] One protocol embodiment of the invention ensures that the information a 
potential eavesdropper may gain at most can be estimated from the measured parameters 
characterising the channel (line attenuation and error rate). Using an authenticated public 
(classical) channel, the resulting raw data (partly correlated continuous variables) can be 
converted into a secret binary key by using a (direct or reverse) reconciliation protocol 
supplemented with privacy amplification. The resulting key can then be used as a private key 
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in order to ensure the confidentiality and/or authentication of a transmission using standard 
cryptographic techniques. 

[0015] Aspects of the quantum continuous-variable cryptographic scheme include 
the continuous distribution of coherent states. This is in contrast with all other schemes, 
which rely on a binary encoding. Here, the encoding of continuous variables into the 
quadrature components of a coherent state makes it possible to encode several key bits per 
coherent pulse. Also, the use of homodyne detection techniques to measure the quadrature 
components of the light field allows this scheme to work at high frequencies by comparison 
with photon-counting techniques. 

[0016] Other aspects of the scheme include the use of a continuous reconciliation 
protocol in order to convert the raw key resulting from the first item into a usable binary key. 
A direct or reverse reconciliation protocol may be used depending on the line parameters. For 
lines with an attenuation that exceeds 3 dB, reverse reconciliation must be used in order to 
ensure the security. There is, in principle, no limit on the achievable range using reverse 
reconciliation, but practical considerations (noise in the apparatuses, in particular in the 
coherent detection system, non-unity efficiency of the reconciliation protocols) put a limit on 
the range over which the key can be securely distributed. For very noisy lines with low 
losses, direct reconciliation is preferred. 

[0017] In one embodiment of the present invention there is a quantum cryptographic 
system, comprising at least one sending unit comprising an encoder and distributing a raw key 
in the quadrature components of quantum coherent states that are continuously modulated in 
phase and amplitude; at least one receiving unit comprising a homodyne detector of the 
quantum coherent states in order to measure the quadrature components of the states; a 
quantum channel for connecting the sending unit to the receiving unit; and a two-way 
authenticated public channel for transmitting non-secret messages between the sending unit 
and the receiving unit. 

[0018] According to one embodiment, the quantum cryptographic system further 
comprises a continuous-variable quantum key distribution protocol ensuring that the amount 
of information a potential eavesdropper may gain at most on the sent and received data can 
be estimated from the measured parameters of the quantum channel (error rate and line 
attenuation). 
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[0019] The sent and received raw data resulting from the continuous-variable 
protocol are converted into a secret binary key by using a continuous reconciliation protocol 
supplemented with privacy amplification. 

[0020] According to one embodiment, the encoder of the quadrature components 
with a high signal-to-noise ratio encodes several key bits per coherent light pulse. 

[0021] According to another embodiment, the decoding of the quadrature 
components of the light field via the homodyne detector achieves high secret bit rates in 
comparison to photon-counting techniques. 

[0022] In case of noisy quantum channels with low losses, the continuous 
reconciliation protocol is a direct reconciliation protocol, which allows the receiver to 
discretize and correct its data according to the sent values. 

[0023] In case of quantum channels with an attenuation that exceeds 3 dB, the 
continuous reconciliation protocol is a reverse reconciliation protocol, which allows the 
sending unit to discretize and correct its data according to the values measured by the 
receiver. 

[0024] The key secret can be used as a private key for ensuring confidentiality 
and authentication of a cryptographic transmission. 

[0025] According to one embodiment, the quadrature components of the quantum 
coherent states are modulated with a Gaussian distribution, the coordinate values of the 
center of the Gaussian distribution being arbitrary. 

[0026] According to another embodiment, the variance of the Gaussian 
distribution for the quadrature X is different from the variance of the Gaussian distribution 
for the conjugate quadrature P. 

[0027] According to another embodiment, the Gaussian-modulated coherent sates 
are attenuated laser light pulses typically containing several photons. 

[0028] The information, an eavesdropper may gain on the sent and received 
Gaussian-distributed values, can be calculated explicitly using Shannon's theory for 
Gaussian channels. 

[0029] In another embodiment of the present invention there is a method of 
distributing continuous quantum key between two parties which are a sender and a receiver, 
the method comprising selecting, at a sender, two random numbers x A and p A from a 
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Gaussian distribution of mean zero and variance V A N 0 , where N 0 refers to the shot-noise 
variance; sending a corresponding coherent state |x A +ip A > in the quantum channel; randomly 
choosing, at a receiver, to measure either quadrature x or p using homodyne detection; 
informing the sender about the quadrature that was measured so the sender may discard the 
wrong one; measuring channel parameters on a random subset of the sender's and receiver's 
data, in order to evaluate the maximum information acquired by an eavesdropper; and 
converting the resulting raw key in the form of a set of correlated Gaussian variables into a 
binary secret key comprising direct or reverse reconciliation in order to correct the errors and 
get a binary key, and privacy amplification in order to make secret the binary key. 

[0030] The reconciliation can produce a common bit string from correlated 
continuous data, which comprises the following: transforming each Gaussian key element of 
a block of size n by the sender into a string of m bits, giving m bit strings of length n, 
referred to as slices; converting, by the receiver, the measured key elements into binary 
strings by using a set of slice estimators; and sequentially reconciliating the slices by using 
an implementation of a binary error correction algorithm, and communicating on the public 

authenticated channel. 

[0031] The post-processing of privacy amplification can comprise distilling a 
secret key out of the reconciliated key by use of a random transformation taken in a universal 

class of hash functions. 

- [0032] Informing the sender can comprise utilizing a public authenticated channel 
by the receiver to inform the sender. The channel parameters can include an error rate and a 
line attenuation. 

[0033] In another embodiment of the present invention there is a device for 
implementing a continuous-variable quantum key exchange, the device comprising a light 
source or a source of electromagnetic signals configured to generate short quantum coherent 
pulses at a high repetition rate; an optical component configured to modulate the amplitude 
and phase of the pulses at a high frequency; a quantum channel configured to transmit the 
pulses from an emitter to a receiver; a system that permits the transmission of a local 
oscillator from the emitter to the receiver; a homodyne detector capable of measuring, at a 
high acquisition frequency, any quadrature component of the electromagnetic field collected 
at the receiver's station; a two-way authenticated public channel that is used to 
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communicating non-secret messages in postprocessing protocols; and a computer at the 
emitter's and receiver's stations that drives or reads the optical components and runs the 
postprocessing protocols. 

[0034] Alternatively, a local oscillator can be transmitted together with the signal 
by use of a polarization encoding system whereby each pulse comprises a strong local 
oscillator pulse and a weak orthogonally-polarized signal pulse with modulated amplitude 
and phase. 

[0035] If polarization encoding is used, the receiving system relies on 
polarization-mode homodyne detection requiring a quarter-wave plate and a polarizing beam 
splitter. 

[0036] In another embodiment of the present invention, there is a device for 
exchanging Gaussian key elements between two parties which are a sender and a receiver, 
the device comprising a laser diode associated with a grating-extended external cavity, the 
laser diode configured to send light pulses at a high repetition rate, each pulse typically 
containing several photons; an integrated electro-optic amplitude modulator and a 
piezoelectric phase modulator, configured to generate randomly-modulated light pulses, the 
data being organized in bursts of pulses; a beam-splitter to separate the quantum signal from 
a local oscillator; and a homodyne detector combining the quantum signal and local oscillator 
pulses in order to measure one of the two quadrature components of the light field. 

[0037] The device may further comprise an acquisition board and a computer on 
the sender's and receiver's sides in order to run the post-processing protocols described here 
above. 

[0038] The laser can operate at a wavelength comprised between about 700 and 
about 1600 nm, or the laser can operate at a wavelength comprising telecom wavelengths 
between about 1540 and 1580 nm. 

[0039] The device may additionally comprise means for selecting, at the emitter, 
two random numbers x A and pa from a Gaussian distribution of mean zero and variance 
V A N 0 , where N 0 refers to the shot-noise variance; means for sending a corresponding 
coherent state |x A +ipA> in the quantum channel; means for randomly choosing, at the 
receiver, to measure either quadrature x or p using homodyne detection; means for informing 
the emitter about the quadrature that was measured so the emitter may discard the wrong one; 
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means for measuring channel parameters on a random subset of the emitter's and receiver's 
data, in order to evaluate the maximum information acquired by an eavesdropper; and means 
for converting the resulting raw key in the form of a set of correlated Gaussian variables into 
a binary secret key comprising direct or reverse reconciliation in order to correct the errors 
and get a binary key, and privacy amplification in order to make secret the binary key. 

Brief Description of the Drawings 

[0040] FIG. 1 is a diagram of one configuration of components demonstrating 
embodiments of the present invention. 

[0041] FIG. 2 is a diagram representing Bob's measured values of the quadrature 
component as a function of Alice's sent values (in Bob's measurement basis) for a burst of 
60,000 pulses exchanged between Alice and Bob in the configuration shown in Figure 1. 

[0042] FIG. 3. is a diagram representing the channel equivalent noise % as a 
function of the channel transmission G, adjusted using a variable attenuator on the signal 
line. 

[0043] FIG. 4 is a diagram representing the values of I B a (increasing curve), Iae 
(decreasing curve), I B e (inverse U-shaped curve) as a function of the channel transmission G 
for V*40. 

Description of Certain Embodiments of the Present Invention 

[0044] One realisation of this quantum cryptographic scheme consists in 
modulating the quadrature components of coherent light pulses with a Gaussian distribution. 
The corresponding protocol is demonstrated in what follows. Dealing with Gaussian 
distributions makes the security of the entire protocol easier to analyse, but the scope of the 
present invention is not limited to such random distributions. Alternative continuous 
distributions may be used as well. Other improvements of the present invention can be 
foreseen, such as the use of more efficient reconciliation protocols that may potentially 
increase the achievable range. 

[0045] The protocol described herein works by continuously modulating the 
phase and amplitude of coherent light pulses and measuring the quadrature components of 
the received coherent states. This clearly gives very important practical advantages to such a 
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protocol, in view of the simplicity of the techniques needed to preparing and detecting 
coherent states. In particular, the high dimensionality of the phase space may be exploited by 
modulating the phase and amplitude quadratures with a large dynamics, allowing the 
encoding of several key bits per pulse. This, together with the fact that fast modulation and 
detection can be achieved, results in a high-rate secret key distribution. 

[0046] This protocol, supplemented with a direct reconciliation scheme, can be 
shown to be secure provided that the transmission of the line is larger than 50%, i.e., the 
transmission loss is less than 3 dB 11 . This is in accordance with the fact that QKD 
fundamentally relies on the use of non-orthogonal states only and may perfectly well work 
with macroscopic signals instead of single photons (see patent US5515438). The security of 
the protocol is related to the no-cloning theorem 12 " 14 , and non-classical features like 
squeezing or EPR correlations have no influence on the achievable secret key rate. The 3 dB 
loss limit of these protocols makes the security demonstration quite intuitive, but there may 
exist in principle multiple ways for two user/partners, e.g., Alice and Bob, to go beyond this 
limit, for instance by using QCV entanglement purification 15 . 

[0047] The concept of reverse reconciliation, detailed below, is an efficient 
technique to cross this 3 dB limit that does not require the generation and purification of 
entanglement, but only a modified classical post-processing. The corresponding coherent- 
state protocol can, in principle, be secure for any value of the line transmission 18,32 . There is 
therefore no theoretical limit on the achievable range over which security can be guaranteed. 
In addition, it can be shown that the cryptographic security is strongly linked with 
entanglement, even though the protocol does not rely on entanglement. 

[0048] Referring to FIG. 1, a configuration of components demonstrating 
embodiments of the present invention will be described. The components are partitioned into 
exemplary use by two users, Alice and Bob. The components include the following: Laser 
diode 102: e.g., SDL 5412 lasing at 780nm; OI 104: e.g., optical isolator; X/2 106: e.g., half- 
wave plate; AOM 108: e.g., acousto-optic modulator; MF 110: e.g., polarization maintaining 
monomode fibre; OD 112: e.g., optical density (attenuator); EOM 114: e.g., integrated 
LiNbC>3 electro-optic amplitude modulator; PBS 116: e.g., polarizing beam splitter; BS 118: 
e.g., beam splitter inducing variable attenuation; and PZT 120: e.g., piezo-electric 
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transductor. The lenses are marked with a "f ' followed by their focal lengths in millimeters. 
R and T are reflection and transmission coefficients. 

[0049] The basic idea behind reverse reconciliation is to interchange the roles of 
Alice and Bob when converting the measured data into a common binary key, that is, Alice 
attempts to guess what was received by Bob rather than Bob guessing what was sent by 
Alice. Consequently, Alice always has an advantage over a potential eavesdropper, Eve, as 
the latter only has a noisy estimate of Alice's data at their disposal in order to guess Bob's 
data. This is, roughly speaking, the mechanism that ensures the security of these new 
protocols. 

[0050] In the description below, the concept of coherent-state QKD supplemented 
with reverse reconciliation is introduced and then an individual attack using an entangling 
doner is described. An explicit expression of the maximum achievable secret key rate is 
deduced. A table-top experiment that generates streams of data corresponding to the protocol 
will be described. Although Alice and Bob are not fully separated in the present 
implementation, the data are created by the same physical process and thus have the same 
structure as they would have in a real cryptographic exchange. Explicitly how to process the 
experimental data to extract the secret key will be demonstrated, that is, reverse 
reconciliation and privacy amplification protocols is performed. Finally, a quantitative 
evaluation of the expected performances of the scheme in a realistic key exchange is given. 

Coherent-State Quantum Key Exchanee and Reconciliation Protocols 

[0051] In a QKD protocol such as BB84, Alice and Bob randomly choose one out 
of two complementary bases for respectively preparing and measuring a quantum signal, so 
their data are significant only when their bases are compatible. After this quantum exchange, 
they thus have to agree on a common basis and discard the wrong measurements. According 
to the present invention, we make use of a coherent-state protocol that extends this principle 
to QCV and runs as follows 11 . First, Alice draws two random numbers x A and p A from a 
Gaussian distribution of mean zero and variance V A No, where N 0 denotes the shot-noise 
variance, and then she sends to Bob the coherent state |x A +ip A >. Next, Bob randomly chooses 
to measure either the quadrature x or p. Then, using a public authenticated channel, he 
informs Alice about the quadrature that he measured so she may discard the wrong one. After 



10 



running this protocol several times, Alice and Bob (and possibly the eavesdropper Eve) share 
a raw key, that is, a set of correlated Gaussian variables that are called key elements. After 
this quantum exchange, Alice and Bob must convert this raw key into a binary secret key by 
proceeding with the various steps described below including channel evaluation, direct or 
reverse reconciliation (to correct the errors and make the key binary), and privacy 
amplification (to make the key secret). 

Channel Evaluation 

[0052] First, Alice and Bob openly compare a sample of their key elements over 
the classical public channel in order to evaluate the error rate and transmission efficiency of 
the quantum channel. The sacrificed key elements must be chosen randomly and uniformly, 
so that they are representative of the whole sequence, and are unknown in advance to Eve. 
Knowing the correlations between their key elements, Alice and Bob can then evaluate the 
amount of information they share (Iab) as well as the information that Eve can have about 
their values (Iae and Ibe). 

[0053] The estimated amount of eavesdropped information has some significance 
later on, in the privacy amplification procedure, when Eve's knowledge is destroyed. Indeed, 
it is known that Alice and Bob can in principle distil a secret key with a size S > sup(Iab-Iae , 
Iab-Ibe) bits per key element 24 . Thus, if S > 0, they can extract a common key from their 
correlated key elements by performing one-way classical communication over a public 
authenticated channel, revealing as little information as possible to Eve. There are actually 
two main options for doing this key extraction that are closely related to the above expression 
for S, namely performing either direct or reverse reconciliation. 

Direct Reconciliation (PR) 

[0054] Alice publicly sends correction information, revealing R bits, so Bob 
corrects his key elements to have the same values as Alice. At the end of this step, Alice and 
Bob have a common bit string of length Iab+R, and Eve knows Iae+R bits of this string 
(slightly more if the reconciliation protocol is not perfect). Therefore Alice and Bob get a 
useable secret key if (Iab-Iae) > 0 at the beginning. We call this "direct reconciliation" (DR) 
because the classical information flow has the same direction as the initial quantum 
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information flow. Direct reconciliation is quite intuitive, but it is not secure as soon as the 
quantum channel efficiency falls below 50% n . It may prove useful, however, for very noisy 
low-loss quantum channels. 

Reverse Reconciliation (RR) 

[0055] Alternatively, in a reverse reconciliation protocol, Bob publicly sends 
correction information and Alice corrects her key elements to have the same values as Bob. 
Since Bob gives the correction information, this reconciliation keeps (Iab-Ibe) constant, and 
provides a useable key if (Iab-Ibe) > 0- We call this "reverse reconciliation" (RR) because 
Alice needs to estimate what will be measured by Bob. Such a procedure is actually closer, in 
spirit, to single-photon QKD as there Bob simply communicates to Alice the time slots where 
he did not detect a photon (Alice thus reconciliates her data with Bob's measured values). 

Privacy Amplification 

[0056] The last step of a practical QKD protocol consists in Alice and Bob 
performing privacy amplification to filter out Eve's information. This can be done by 
properly mixing the reconciliated bits so as to spread Eve's uncertainty over the entire final 
key as described above. This procedure requires having an estimate of the amount of 
information collected by Eve on the reconciliated key, so we need to have a bound on Iae for 
DR or on I B e for RR. In addition, Alice and Bob must keep track of the number of bits 
exchanged publicly during reconciliation since Eve might have monitored them. This 
knowledge is destroyed at the end of the privacy amplification procedure, reducing the key 
length by the same amount. For a coherent state protocol, the DR bound on I A e given in 11 
leads to a security limit for a 50% line transmission as mentioned above. The RR bound on 
Ibe> is now established and shown that it is not associated with a minimum value of the line 
transmission. 

Eavesdropping Strategy Based on an Entangling Cloner 

[0057] In order to eavesdrop a reverse reconciliation scheme, Eve needs to guess 
the result of Bob's measurement without superimposing too much noise- on Bob's data. We 
will call "entangling doner" 18,32 a system allowing her to do so. Such a cloner creates two 
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quantum-correlated copies of Alice's quantum state, so Eve simply keeps one of them and 
sends the other one to Bob. Let (x in , pin) be the input field quadratures of the entangling 
doner, and (x B ,p B ), (*e,Pe) the quadratures of Bob's and Eve's output fields. To be safe, 
Alice and Bob must assume Eve uses the best possible entangling doner knowing Alice- 
Bob's channel quality: Eve's doner should minimise the conditional variances 16 " 17 V(x B |x E ) 
and V(pb|pe)> i.e., the variance of Eve's estimates of Bob's field quadratures (x b ,Pb). As 
described above, these variances are constrained by Heisenberg-type relations, which limit 
what can be obtained by Eve, 

V(x b |x a )V(pb|pe) > No 2 and V(p b |pa)V(x b |xe) > N 0 2 (1) 

[0058] where V(x B |x A ) and V(p b |pa) denote Alice's conditional variances. This 
means that Alice and Eve cannot jointly know more about Bob's conjugate quadratures than 
allowed by the Heisenberg principle, even if they conspire together. As we shall see, Alice's 
conditional variances can be bounded by using the measured parameters of the quantum 
channel, which in turn makes it possible to bound Eve's variance. Here, the channel is 
described by the linearized relations x B = VG x (x in +B x ) and p B = VG p (pi n +B p ), with <x itl 2 > = 
<p in 2 > = VN 0 > No, <B X , P 2 > = Xx,pN 0 , and <x in B x > = <p in B p > = 0. The quantities Xx, Xp 
represent the channel noises referred to its input, also called equivalent input noises 16 " 17 , 
while G x , G p are the channel gains for x and p (G x , p < 1 for a lossy transmission line), and V 
is the variance of Alice's field quadratures in shot-noise units (V=V A +1). 

[0059] Now comes the crucial point of the demonstration. The output-output 
correlations of the entangling doner, described by V(x B |x E ) and V(p B |p E ), should only depend 
on the density matrix D in of the field (x in ,pi n ) at its input, and not on the way Alice produced 
this field namely whether it is a Gaussian mixture of coherent states or one of two EPR- 
correlated beams. Inequalities (1) thus have to be fulfilled for every physically allowed 
values of V(x B |x A ) and V(p b |pa) given D in . If we look for a bound to Eve f s knowledge by 
using (1), we have thus to use the smallest possible value for V(x B |x A ) and V(p B |p A ) given 
Di n . hi particular, we must assume that Alice uses EPR beams to maximise her knowledge of 
Bob's results, even though she does not do so in practice. The two-mode squeezing (or 
entanglement) that Alice may use is, however, bounded by the variance of her field V, which 
in turn implies a limit on how well Alice can know Bob ! s signal as described above: 

VQtelp^^GpCxp+V^No and V(x B |x A ) > G x (Xx+V l )N 0 (2) 
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[0060] These lower bounds may be compared with the actual values if Alice 
sends coherent states, that is, V(x B |x A ) C oh = G x (x x +1) N 0 and V(p B |pA)coh = G p (x P +l) No- 
Nevertheless, if we look for an upper bound on Eve's knowledge by using (1), we need to use 
the pessimistic limits given by (2), which implies 

V(xb|x e ) > No/fGpCxp+V 1 )} and V(p b | P e) > No/IGxCxx+V 1 )} (3) 
[0061] It is worthwhile asking whether Eve can reach these bounds. In a practical 
QKD scheme, Alice and Bob will give the same roles to x and p, and Bob will randomly 
choose one of them, as explained above. Assuming therefore that G x = G p = G and Xx = Xp = 
X, the two bounds of (3) reduce to V(B|E) > No/{G(x+V" 1 )}. An entangling doner achieving 
this limit can be sketched as follows. Eve uses a beamsplitter with a transmission G < 1 to 
split up a part of the signal transmitted from Alice to Bob, and she injects into the other input 
port a field Em that will induce a noise with the appropriate variance at Bob's end. In order to 
fully control this field Em, Eve will inject one of two EPR-correlated beams, and she will 
keep the second one until Alice and Bob have revealed their bases. This ensures Eve is 
maximally entangled with Bob's field, compatible with the noise observed by Bob (this is an 
"entangling" attack). A straightforward calculation 18 shows that such an entangling doner 
does reach the lower limit of (3). 

Security Condition and Secret Bit Rate for a Reverse Reconciliation Protocol 

[0062] In a reverse quantum cryptography protocol, Eve's ability to infer Bob's 
measurement is limited by the inequalities (3) and one must assume that a "perfect" Eve is 
able to reach these limits. In order to estimate the limits on information rates, we use 
Shannon's theory for Gaussian additive-noise channels (Shannon). The information shared 
by Alice and Bob is given by the decrease of Bob's field entropy that comes with the 
knowledge of Alice's field, i.e., Iab=H(B)-H(B|A). For a Gaussian distribution, the entropy is 
given, up to a constant, by H(B)=(l/2) log2(V B ) bits per symbol, where V B is the variance. 
For simplicity, we assume here that the channel gains and noises, and the signal variances are 
the same for x and p. In practice, deviations from this should be estimated by statistical tests). 
Thus, according to Shannon's formula, the information rates I B a and I B e are given by: 
Iba = (l/2)log 2 [V B /(V B | A ) coh ]Kl/2)log 2 [(V^)/(l^)^ (4a) 
I BE =(l/2)log 2 [V B /(V B | E ) min ]Kl/2)log 2 [G 2 (V+x)(V- 1 + x )] (4b) 
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where V B = <x B 2 > = <Pb 2 > =.G(V+x)N 0 is Bob's variance, (V B |E)min = V(x B |xE)min = 
V(pB|pE)min = No/{G(x+V"')} is Eve's minimum conditional variance, and (Vb|a)co1i = 
V(x B |x A )coh = V(p B |p A )coh = G(x+1)N 0 is Alice's conditional variance for a coherent-state 
protocol. The secret information rate for such a reverse reconciliation protocol is thus ' 

AIrr =I ba -Ibe = -(l/2)log2[G 2 (l+x)(V l +2C)] (5) 
and the security is guaranteed (AI>0) provided that G 2 (l+x) (V _1 +x) < 1. For a direct 
reconciliation protocol, a similar calculation gives AI DR = Iab-Iae = (l/2)log 2 [(V+x)/(l+ 
Vx)] so the security is guaranteed if %<l. The equivalent input noise % includes two 
contributions: one is the "vacuum noise" due to the losses along the line, given by Xvac = (1- 
G)/G. The noise above vacuum noise, which we call "excess noise", is defined as e = X-Xvac = 
X -(1-G)/G. In the limit of high losses (G « 1) one has AIrr « -(l/2)log 2 [l+G(2s+V" 1 -l)], 
and thus the protocol will be secure provided that s < (V-1)/(2V) ~ 1/2. Therefore RR may 
indeed be secure for any value of the line transmission G provided that the amount of excess 
noise s is not too large. This is an important difference with DR, which may tolerate large 
excess noise but requires low line losses since we have the conditions G > 1/2 and e < (2G- 
1)/G. 

[0063] It should be emphasised that squeezing and entanglement do play a crucial 
role in the security demonstration, even though we deal with a coherent state protocol. This is 
because the bound on I B a is obtained by assuming that Alice may use squeezed or entangled 
beams, and the bound on I B e can be achieved only if Eve uses an entangling attack. 
Therefore, though we did not consider the most general situation of a collective and/or non- 
Gaussian attack on the whole key exchange between Alice and Bob, we can reasonably 
conjecture that the security proof encompasses all eavesdropping strategies. 

Detailed Description of an Experimental Optical Set-Up 

[0064] In order to exchange correlated sets of Gaussian variables with Bob, Alice 
sends randomly modulated light pulses of 120 ns duration at a 800 kHz repetition rate. Each 
pulse contains up to 250 photons, and Bob performs an homodyne measurement of either x 
or p, using local oscillator (LO) pulses, containing about 10 8 photons, that are also 
transmitted to him. One configuration of an experimental set-up 32 is shown on FIG. 1. The 
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channel losses are simulated by inserting a variable attenuator between Alice and Bob. FIG. 2 
shows a data burst of 60,000 pulses measured by Bob, as a function of the amplitude sent by 
Alice in Bob f s measurement basis. The line transmission is 100% and the modulation 
variance is V = 41.7. The solid line is the theoretical prediction (slope equal to one), and the 
insert shows the corresponding histograms of Alice's (gray curve) and Bob's (black curve) 
data. 

[0065] The laser source consists of a commercially available CW laser diode 
(SDL 5412) at 780nm associated with an acousto-optic modulator, that is used to chop pulses 
with a duration 120 ns (full width half-maximum), at a repetition rate 800 kHz. In order to 
reduce excess noise, a grating-extended external cavity is used, and the beam is spatially 
filtered using a polarisation maintaining single mode fibre. Light pulses are then split onto a 
10% reflecting beam-splitter, one beam being the local oscillator (LO), the other Alice's 
signal beam. The data is organised in bursts of 60000 pulses, separated by time periods that 
are used to lock the phase of the LO and sequences of pulses to synchronise the parties. In 
the present experiment, there is a burst every 1.6 seconds, which corresponds to a duty cycle 
of about 5%, but this should be easy to improve. 

[0066] The desired coherent state distribution is generated by Alice by 
modulating randomly both the amplitude and phase of the light pulses with the appropriate 
probability law. In the present experiment, the amplitude of each pulse is arbitrarily 
modulated at the nominal 800 kHz rate. However, due to the unavailability of a fast phase 
modulator at 780 nm, the phase is not randomly modulated but scanned continuously from 0 
to 2n using a piezoelectric modulator. For such a determinist phase variation, the security of 
the protocol is of course not warranted and thus no genuine secret key can be distributed. 
However, the experiment provides realistic data, that will have exactly the awaited structure 
provided that random phase permutation on Bob's data are performed. The amplitude 
modulator is an integrated electro-optic LiNb03 Mach-Zehnder interferometer, allowing for 
small voltages inputs (V^ = 2.5V) at 780nm. All voltages for the electro-optic modulator or 
the piezoelectric transductor are generated by an acquisition board (National Instruments 
PCI6111E) connected to a computer. Though all discussions assume the modulation to be 
continuous, digitised voltages are obviously used in practice. With the experimental 
parameters, a resolution of 8 bits is enough to hide the amplitude or phase steps under shot 
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noise. Since the modulation voltage is produced using a 16 bits converter, and the data is 
digitised over 12 bits, we may fairly assume the modulation to be continuous. Due to an 
imbalance between the paths of the interferometer, the modulator extinction is not strictly 
zero. In the present experiment that is only aimed at a proof of principle, the offset field from 
the data received by Bob is subtracted. In a real cryptographic transmission, the offset field 
should be compensated by Alice, either by adding a zeroing field, or by using a better 
modulator. For each incoming pulse, either the x or p signal quadrature is measured by 
appropriate switching of the LO phase. The homodyne detection was checked to be shot- 
noise limited for LO power up to 5xl0 8 photons/pulse. The overall homodyne detection 
efficiency is 0.76, due to the optical transmission (0.9), the mode-matching efficiency (0.92) 
and the photodiode quantum efficiency (0.92). 

[0067] The experiment is thus carried out in such a way that all useful 
parameters - such as photon numbers, signal to noise ratios, added noises, information rate, 
etc. - can be measured experimentally. Reconciliation and privacy amplification protocols 
can thus be performed in realistic - though not fully secret - conditions. The limitations of 
the present set-up are essentially due to the lack of appropriate fast amplitude and phase 
modulator at 780 nm. This should be easily solved by operating at telecom wavelengths 
(1540-1580 nm) where such equipment is readily available. 

[0068] Referring to FIG. 3, the curve is the theoretical prediction Xvac = (1-G)/G. 
The error bars include two contributions with approximately the same size, from statistics 
(evaluated over bursts of 60,000 pulses) and systematics (calibration errors and drift). After 
the quantum exchange, Alice and Bob evaluate the total added noise by calculating the 
variance of the difference between their respective values. This variance has four 
contributions: the shot noise No, the channel noise x N o, the electronics noise of Bob's 
detector (N e j =0.26N 0 ), and the noise due to imperfect homodyne detection efficiency (N h0 m 
=0.32N 0 ). In the absence of line losses, the measured x is (0.01±0.04), while it is expected to 
be zero* This is attributed to various calibration errors and drifts in the set-up, and gives an 
idea of the experimental uncertainty in the evaluation of the channel noise. In presence of 
line losses, the measured % increases as (1-G)/G as expected, see FIG. 3. 

[0069] Referring to FIG. 4, the value of I B e is calculated by assuming that Eve 
cannot know the noises N e i and Nhom, which are internal to Bob's detector. This corresponds 



17 



to a "realistic" hypothesis, where the noise of Bob's detector is not controlled by Eve. The 
theoretical value of I A e is also plotted in order to compare RR with DR. 

[0070] The detection noises N c i and N h0 m originate from Bob's detection system 
only, so one may reasonably assume that they do not contribute to Eve's knowledge. In this 
"realistic" approach, I B e is given by Eq.(4b) with % being the channel noise (i.e., subtracting 
the detection noises). In FIG. 4, I B e is plotted together with the value of I B a as given by Eq. 
(4a), where % is now the total equivalent noise including both transmission and detection. 
The difference between these two curves gives the achievable secret key rate in reverse 
reconciliation AIrr as a function of the line transmission G. We also show Alice-Eve 
information I A e = (l/2)log 2 [(V+x' 1 )/(lX* l )] ? corresponding to a direct reconciliation 
protocol 11 , with % being the channel noise. The comparison of the DR and RR protocols is 
straightforward by looking at FIG. 4. 

Computer Simulation of the Secret Key Distillation 

[0071] One aspect in the protocol is to design a (direct or reverse) reconciliation 
algorithm that can efficiently extract a binary common key from the measured data. A 
computer program that performs the various steps of secret key distillation described above, 
namely channel evaluation, reconciliation, and privacy amplification 32 was written. Under the 
scope of this "proof-of-principle" experiment, Alice and Bob are simulated on the same 
computer, although it poses no fundamental problem to make them remotely communicate 
over a network. This would require the use of a classical public authenticated channel in 
addition to the quantum channel. The designed program accepts as input the sequences of 
Alice's sent values and Bob's measurement outcomes, and produces a secret key as detailed 
below. First, Alice's and Bob's key elements are compared in order to measure the relevant 
parameters of the quantum channel, namely the overall transmission G and added noise %. 
The estimation of Eve's knowledge is based on Eq.(4), that gives a bound on I B e once G and 
X are known to Alice and Bob. Then, a reconciliation algorithm is performed, with as few 
leaked bits to Eve as possible. Protocols based on discrete quantum states such as BB84 20 can 
use a discrete reconciliation protocol, for example Cascade 21 . In contrast, since continuous 
key elements are produced here, we instead needed to develop a "sliced" reconciliation 
algorithm 9,22 , which produces a common bit string from correlated continuous key elements 
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as described above. Finally, we carry out privacy amplification in such a way that, loosely 
speaking, every bit of the final key is a function of most if not all of the reconciliated bits. 
Following 23 " 25 , we can reduce the size of the key by (nI BE +rf A(n)) bits, where r indicates the 
public information leaked during the reconciliation of the sequence of size n, and A(n) is an 
extra security margin as described above. This follows from the assumption that Eve can 
only use individual attacks, so that we can consider key elements and eavesdropping as 
independent repetitions of identical random processes. 

Demonstration of Relevant Heisenberg Relations 

[0072] Let us consider the situation where Alice tries to evaluate x B , and Eve tries 
to evaluate p B in a reverse reconciliation protocol. The corresponding estimators can be de 
noted as ctx A for Alice and Pp E for Eve, where a and p can be taken as real numbers. The 
errors for these estimators will be x B |a, a = *b - cxx A , and p B |E,p = Pb - Ppe- Since all operators 
for Alice, Bob and Eve commute, one has obviously [x B | A>ot ,PB|E,p] = [*b,Pb] m & th us we 8 et 
the Heisenberg relation Ax B | A , a 2 Ap B |E,p 2 ^ N 0 2 . Since the conditional variances are by 
definition given by V(x B |x A ) = mina{Ax B | A , a 2 } and V(p B |p E ) = min p { Ap B | E , p 2 }, we obtain the 
expected relation V(x B |x A ) V(p B |p E ) > N 0 2 . Exchanging the roles of x and p, one gets also the 
symmetrical relation V(p B |p A ) V(x B |x E ) > No . 

[0073] Alice has the estimators (x A ,p A ) for the field (x in ,pi n ) that she sends out, so 
that one can write x in = x A + A x and p in = p A + A p with <A X 2 > = <A P 2 > = sNo , where s is 
related to the amount of squeezing that may be used by Alice to generate this field, and obeys 
s > V" 1 . By calculating the correlation coefficients <p A 2 > = (V - s) N 0 , <p B 2 > = G p (V + x P ) 
No, and < p A p B > = VG P <p A 2 >, one obtains Alice f s conditional variance on Bob's 
measurement, V(p B |p A ) = <p B 2 > - |<p a Pb>| 2 /<Pa 2> = G p (s+x P )N 0 . This equation and the 
constraint s > V" 1 gives finally V(p B |p A ) > G P (V^+Xp) N 0 » and similarly V(x B |x A ) > G X (V* 
l +X x )No by exchanging the roles of x and p. 

Detailed Description of Sliced Reconciliation 

[0074] We assume that Alice and Bob share correlated Gaussian key elements 
from which they wish to extract I(A; B) common bits, where A (resp. B) denotes the random 
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variable representing one of Alice's (resp. Bob's) Gaussian key elements, described using 
their binary expansion. In order to deal with realistic streams of data despite the non-random 
phase modulation used in the current experiment, the key elements must actually be 
randomly permuted before processing. The reconciliation procedure 9 ' 22 works in the 
following way. Alice chooses m functions Si(A),...,S m (A) that map her key elements onto {0, 

1 } m . If Alice and Bob exchanged a block of n key elements Ai A n , Alice thus creates m bit 

strings of length n, called "slices", by applying each function Si to all her key elements: 
Sj(Ai),..., Si(A n ). Then Alice and Bob reconciliate each slice sequentially for i=l...n. Since 
this comes down to reconciliating bit strings, we used an implementation 19 of the binary error 
correction algorithm Cascade 21 . Bob, on his side, must also convert his key elements Bi,...,Bn 
into binary strings. To this end, he uses another set of functions R i5 called "slice estimators", 
which estimate the bits Si(A) given Bob's current knowledge. Since the slices are corrected 
sequentially for i=l,...,m, Bob already knows Si(A),...,Si-i(A) upon correcting slice i, so that 
the slice estimator R ; is a function of B and of the previous reconciliated slices, that is Ri(B; 
Si(A),...,Si-i(A)). It remains to detail how the functions Si are created. On the one hand, we 
wish to extract as many bits as possible out of A and B, but, on the other hand, any bit leaked 
during the binary reconciliation with Cascade does not count as a secret bit since it is 
publicly known. The difference between these two quantities defines the net amount of 
(potentially secret) reconciliated bits per key element, which can be expressed as 
H(Si(A),...,S m (A))-Zih(eO, where the first term is the entropy of the Alice's produced bits, and 
ei = Pr[Ri(B;Si(A),...,Sj-i(A)) * Sj(A)]. This uses the fact that, according to Shannon theory, 
at least n h(e) bits must be disclosed to correct a string of length n with bit error probability e, 
where h(x) = - x log 2 x - (1-x) log2(l-x). Note that in practice Cascade leaks a little bit more 
than Shannon's formula. In the case of the current set-up, it appeared useless to reconciliate 
the bits beyond some precision level, so we chose to use m = 5 slices as a trade-off between a 
satisfactory number of reconciliated bits and reasonable computing resources. We discretized 
the field amplitudes into 2 m = 32 intervals, numbered from 0 to 31. What was found to work 
best 22 is to assign the least significant bit of the interval number to Si(A), the second least 
significant bit to S 2 (A), and so on, up to the most significant bit to S 5 (A). In other words, the 
reconciliation is carried out from a fine-grained level to a coarse-gained level. We then 
numerically optimized the interval boundaries so as to maximise the net amount of 
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reconciliated bits. It should be stressed that the binary error correction algorithm used in this 
implementation, Cascade 21 , is a two-way interactive protocol, so that the information leaking 
to Eve should be estimated carefully. For example, in RR, Eve may gain some knowledge on 
Alice's value that might give her some additional information on the key (Bob's value). The 
same problem occurs in DR, but to a smaller extent. This additional information, which 
reduces the number of secret bits, must be evaluated numerically 32 . 

Detailed Description of Privacy Amplification 

[0075] Privacy amplification amounts to process the reconciliated key into a 
random transformation taken in a universal class of hash functions 25,26 . In this case, we chose 
the class of truncated linear functions in a finite field. This means we considered the 
reconciliated bits as coefficients of a binary polynomial in a representation of the Galois field 
GF(2 110503 ) whose size allows to process up to 1 10503 bits at once, and hashing was achieved 
by first multiplying the reconciliated polynomial with a random element of the field and then 
extracting the desired number of least significant bits 32 . This operation can be implemented 
efficiently (see e.g. 27 ). In practice, the explicit knowledge of a prime polynomial over GF(2) 
is needed to perform the modular reduction, so we used the polynomial 28 x 110503 +x 519 +L 
Finally, the number of extracted bit is n H(Si(A),..., S m (A))-I(A;E)-r-A(n), where we reduced 
the final key size by some extra amount A(n), which depends on the actual number of key 
elements and the desired security margin. The evaluation of A(n), which is basically a finite 
size effect, will not be described here. 

Evaluation of the Proposed OKD Schemes 

[0076] Table 1 shows the ideal and practical secret key rates of the direct- 
reconciliation and reverse-reconciliation QKD protocols for several values of the line 
transmission G. The RR scheme is in principle efficient for any value of G, provided that the 
reconciliation protocol achieves the limit given by Iba- However, in practice, unavoidable 
deviations of the algorithm from Shannon's limit reduce the actual reconciled information 
shared by Alice and Bob, while I B e is of course assumed unaffected. For high modulation 
(V«40), the reconciliation efficiency lies around 80%, which makes it possible to distribute a 
secret key at a rate of several hundreds of kbits per second for low losses. However, the 
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achievable reconciliation efficiency drops when the signal-to-noise ratio (SNR) decreases, so 
that no secret bits can be extracted when the channel gain G is too low. This can be improved 
by reducing the modulation variance, which increases the ratio Iba/Ibe so the constraint on 
the reconciliation efficiency is less severe. Although the ideal secret key rate is then lower, 
we could process the data with a reconciliation efficiency of 78% for G = 0.49 (3.1 dB) and 
V=27, resulting in a net key rate of 75 kbits/s. This clearly demonstrates that RR continuous- 
variable protocols operate efficiently at and beyond the 3dB loss limit of DR protocols. We 
emphasize that, although we were not able to extract a key well above 3 dB in this "proof-of- 
principle" experiment, an increase of the reconciliation efficiency would immediately 
translate into a larger achievable range. 

[0077] The QCV protocol can be compared with single-photon protocols on two 
aspects: the raw repetition frequency and the secret key rate in bits per time slot. In photon- 
counting QKD, the key rate is intrinsically limited by the maximum repetition frequency of 
the single-photon detector, typically of the order of 100 kHz, due to the lifetime of trapped 
charges in the semiconductor. In contrast, homodyne detection may run at frequencies of up 
to tens of MHz. In addition, a specific advantage of the high dimensionality of the QCV 
phase space is that the field quadratures can be modulated with a large dynamics, allowing 
the encoding of several key bits per pulse. Very high secret bit rates are therefore attainable 
with the coherent-state protocol when using transmission lines of low losses (up to about 
3 dB in the present implementation). For high-loss transmission lines, the protocol is 
presently limited by the reconciliation efficiency, but its intrinsic performances remain very 
high. Let us consider an ideal situation where the reconciliation algorithm attains Shannon's 
bound and the excess noise is negligible. Then, the net key rate of the protocol is slightly 
above that of BB84, which yields G n ph /2 secret bits per time slot for a noiseless line, where 
n ph is the number of photons sent per time slot. Taking for instance a 67.1 km line (typical 
current distance for state-of-the-art single-photon QKD 30 ) with 14.3 dB loss and a reasonable 
modulation V = 10, the protocol would ideally yield a secret key rate of 0.025 bits per time 
slot. Thus, assuming perfect reconciliation and a pulse repetition rate of a few MHz, the QCV 
protocol could achieve a secret key rate as high as 100 kbits/sec. Note, however, that I B a - 
0.208 bits per time slot in this case, so that a reconciliation efficiency of about 90 % would 
actually be needed in a regime of very low (around -5 dB) signal-to-noise ratio. The currently 
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available reconciliation protocols do not reach this regime. For comparison, the secret key 
rate of BB84 with an ideal single-photon source and perfect detectors would be at best 0.019 
bits per time slot with the same line, and even one order of magnitude smaller using 
attenuated light pulses with n P h = 0.1. 

[0078] This application incorporates by reference the subject matter as was 
originally filed, a portion of which was excised to meet PTO publication requirements. 

[00790078] Although the present "proof-of-principle" setup is far from reaching 
these numbers, there is still a considerable margin for improvement, both in the hardware and 
the software. For example, working at telecom wavelengths where fast modulators are 
available would overcome some of the technical limitations of the present set-up. Concerning 
the receiver's system, increasing the detection bandwidth or the homodyne efficiency, and 
decreasing the electronic noise would significantly enhance the achievable range. Also, 
significant improvement may result from further research on reconciliation algorithms 31 . This 
suggests that the way is open for testing the present proposal as a practical, high bit-rate, 
quantum key distribution scheme over moderate distances. 
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[00800079] Table 1 summarizes the parameters of the quantum key exchange for 
several values of the line transmission G (the corresponding losses are given in dB). The 
variations of Alice's field variance V are due to different experimental adjustments. The ideal 
secret key bit rates would be obtained from the measured data with perfect key distillation, 
yielding exactly Iba-Ibe bits (RR) or Iab-Ue (DR). The practical secret key bit rates are the 
one achieved with the current key distillation procedure ("-" means that no secret key is 
generated). Both bit rates are calculated over bursts of about 60,000 pulses at 800 kHz, not 
taking into account the duty cycle («5 %) in the present setup. 
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